GitHub details fine-tuned model for secret detection

GitHub’s fine-tuned secret-detection model examines nearby code to identify likely credentials, including passwords that do not match a known token pattern, and does not generate code or prose, helping developers catch secrets before exposure. Existing AI-detected password-alert scans have automatically moved to the model for customers with those alerts, and remain included in GHSP and GHAS at no extra cost.

Secret checks during push protection are in private preview; checks through Copilot’s /security-review command are expected in private preview soon. Push protection is for GitHub Team and GitHub Enterprise Cloud customers with GHSP or GHAS coverage, and an administrator must enable it under organization or enterprise policies. Those opt-in push checks will use GitHub AI Credits; usage is planned to begin in coming weeks. GitHub also plans public-preview AI-detected alerts for GHES 3.23, included with an existing GHSP or GHAS purchase.